CVE-2019-5064 Out-of-bounds Write in OpenCV

What is CVE-2019-5064?

CVE-2019-5064 is a high-severity memory corruption vulnerability in Oracle Application Testing Suite, published on 3 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

Weakness: CWE-787, CWE-120

Which versions are affected by CVE-2019-5064?

12 open source packages ship an affected version, including opencv-contrib-python, opencv-contrib-python-headless and opencv-python. It affects 4 products.

Products include Opencv Opencv, Oracle Application Testing Suite, Oracle Big Data Spatial and Graph, Oracle Enterprise Manager Base Platform.

How do I fix CVE-2019-5064?

Upgrade opencv-contrib-python to 4.2.0.32 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-5064 being exploited?

There is no known exploitation of CVE-2019-5064 in the wild and no public exploit code.

Other vulnerabilities in Oracle Application Testing Suite

• CVE-2019-5063 Out-of-bounds Write in OpenCV High 8.8
• CVE-2019-14491 Out-of-bounds Read in OpenCV High 8.2
• CVE-2019-14492 Out-of-bounds Read and Out-of-bounds Write in OpenCV High 7.5
• CVE-2018-7712 Denial of service in n/a High 7.5
• CVE-2018-7713 Denial of service in n/a High 7.5

All Oracle Application Testing Suite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-5064, GHSA-q799-q27x-vp7w, PYSEC-2026-2802, PYSEC-2026-2828, PYSEC-2026-2841, PYSEC-2026-725.